Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits – 04 August 2024

  • by Bart Busschots

    • Feedback & Followups

    Deep Dive 1 — CloudStrike Follow-up

    Now that the dust has settled a little, some more details have emerged about what exactly happened last month when a CloudStrike update killed thousands of Windows computers across big businesses around the world and triggered global chaos.

    The key facts we now know:

    1. The error was caused by a relatively new parsing module introduced in March, and the update was to a data collection template being processed by this parser — this means the error was in sensor code, not protection code.
    2. CloudStrike are changing their deployment practices to include tiered rollouts so problems can be nipped in the bud before they get universally deployed.
    3. Users did have the option to choose to stay a specific number of updates behind, but for cybersecurity reasons, most chose not to remain un-patched for any amount of time.

    Bart’s key observation: sensor updates should never have been pushed out as aggressively as protection rules. CrowdStrike need to break their update settings into two separate update types — one for protection rule updates, and one for sensor rule updates. If I were a customer I would want to get the very latest protections, but I would want to stay one or two updates behind on sensor rules to half my risk of a bad update bricking everything!

    A Deeper Technical Analysis (from Bart)

    My initial take was that Cloud Strike had no choice but to run as a kernel drive, and that Macs offer no more protection from a bug in a security tool than Windows does. My focus was on the fact that enforced digital signatures only guarantee accountability — so we always know which developer to blame when a third party crashes the macOS kernel. That’s true, but my understanding of the state of play with kernel code on the Mac was one important development behind.

    I now know that security tools running on modern versions of macOS & Linux using the latest APIs cannot take down the entire OS like CrowdStrike did on Windows.

    Why? Because Apple & the open source community have provided cybersecurity companies with new APIs that let cybersecurity software hook all security-related kernel events without extending the kernel. In Apple’s universe that’s a dedicated type of System Extension for Endpoint Security, and in the open source universe that’s a very powerful technology called eBPF.

    Cybersecurity companies are not running in the Kernel on Windows because they want to, but because they have to. No one is better aware of the dangers of kernel code than cybersecurity companies, so they don’t need to be sold on the advantages of getting their code out of the kernel and into user-land where their bugs become app-crashing rather than system-crashing.

    This is why CrowdStrike does not use an old-fashioned kernel extension (KEXT) on the Mac, and why the cybersecurity industry is busy migrating their Linux products to eBPF.

    The real lesson here should be that Microsoft urgently need to add a safe alternative to kernel drivers like Apple’s Endpoint Security System Extensions API, or, ideally incorporate support for the open eBPF specification into Windows.

    Links

    Deep Dive 2 — Google Changes Course on 3rd-Party Cookies

    TL;DR: Google has abandoned its plans to end support for 3rd-party cookies in early 2025. They will keep developing their ‘Privacy Sandbox’ technologies in the hope the advertising industry switches to them and away from 3rd-party cookies, and in the near term, add some kind of user consent screen that they claim will ask users for informed consent to being tracked via 3rd-part cookies.

    The summary above covers the facts, so the remainder of this segment is opinion by Bart.

    For context, both Apple & Mozilla have disabled 3rd-party cookies for many years now, so this is not a technical problem. Instead, this is a political problem caused by the combination of Google’s inherent conflict of interest and their dominant market position.

    Google currently holds about 65% of the browser market share, with Safari a distant second with less than 20% and no other browser crossing the 3% threshold. Having close to 3 times the market share of your nearest competitor would probably be enough to get you some regulatory scrutiny in any case, but Google are also big players in online advertising, and they sell ads based on tracking users. This means that any changes they make in how their competitors can use browsers to track people immediately result in claims of anti-competitive behaviour.

    While I thought some of Google’s early attempted cookie replacements trialed under the ‘Privacy Sandbox’ branding were ill-advised and not actually good for users, I think their latest offering, the Topics API, actually strikes a good balance between privacy and ad targeting. In fact, were this same technology not coming from Google, such a clearly compromised player, but from a standards body like the W3C, then I think it would stand a good chance of being adopted.

    As I understand it, Google have committed to not preferencing their own services in Chrome, so in theory, had they gone ahead and removed 3rd-party cookies, they would have stopped using them for their own ad products too. However, from the POV of their competitors, would it be reasonable to trust Google to develop and manage a standard they depend on for their primary income source fairly? Surely Google would be incentivised to weight the feature set to their benefit, giving higher priority to features they want, and lower priorities to features requested by their competitors? As I like to say, incentives are like roads, you don’t have to follow them, but it sure is easier when you do, and in reality, most people stay on the road!

    Finally, based on my reading of the past few years of tech news, it seems clear regulators are being heavily lobbied by the ad industry who are extremely reluctant to change their ways. The like the privacy-invading status quo, and will do anything to keep things as they are for as long as possible. They failed to stop Apple’s App Tracking Transparency because while Safari has a big market share, Apple does not have the same clear conflict of interest Google does. But convincing EU and UK regulators that a big evil US tech giant is destroying local ad companies with their proposed tracking changes proved to be doable. The last delay was announced in response to on-going negotiations with UK regulators, and their concern was not user privacy, but the future of the ad industry. It seems obvious to me the regulators have been swayed by ad companies, and pushed into perverting anti-trust laws intended to protect consumers into a tool for perpetuating user-hostile business practices.

    I can only see one user-friendly path forward — Google have to step back from taking any kind of lead, and hand the privacy sandbox over to a genuinely independent industry group. They need to contribute, but it needs to be transparently obvious that they are not in the driving seat, otherwise, the ad industry will always succeed in abusing competition laws to block privacy protections.

    Links

    ❗ Action Alerts

    Notable News

    Interesting Insights

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top